Enterprise Cyber Security Architect (Work From Home)
@ LHC Group
Develop and maintain a security architecture process that enables the enterprise to develop and implement security solutions and capabilities that are clearly aligned with business, technology, and risk drivers.
Develop and maintain security strategy plans and roadmaps based on sound enterprise architecture practices.
Develop and maintain security architecture artifacts (eg models, templates, standards and procedures) that can be used to leverage security capabilities in projects and operations.
Track developments and changes in business and threat environments to ensure that they are adequately addressed in security strategy plans and architecture artifacts.
Participate in application and infrastructure projects to provide security planning advice.
Draft security procedures and standards to be reviewed and approved by executive management and the CISO.
Determine baseline security configuration standards for operating systems, network segmentations, applications, Identity and Access Management.
Develop and maintain standards and practices for data encryption and tokenization based on LHC’s data classification criteria.
Conduct threat modeling of services and applications that tie to the risk and data associated with the service or applications.
Ensure a complete, accurate, and valid inventory of all systems, infrastructure, and applications that should be logged by the Security Information and Event Management (SIEM).
Establish a taxonomy of Indicators Of Compromise (IOCs) and share this detail with other cyber security team members, including the Security Operations Center (SOC), Cyber Security Manager, Cyber Security Analyst, Enterprise Operations Center (EOC), and other stakeholders.
Mentor, train, and validate with the application teams to advocate secure coding practices and to escalate concerns related to poor coding practices to the CISO.
Coordinate with the Chief Compliance Officer and Quality Management office to document data flows of sensitive information in the organization, recommend, and validate controls to ensure that this data is adequately secured.
Validate IT and Supplier infrastructure and other reference architectures for security best practices and recommend changes to enhance security and reduce risk, where applicable.
Validate security configurations and access to security infrastructure tools, including firewalls, IPS, WAFs, EDDR, DLP, email filter, proxy filter, and other security tools.
Review solutions and infrastructure to ensure least privilege for access.
Liaise with IT and LHC vendor management teams to conduct third party risk / security assessments of existing and prospective partners, especially those with which LHC shares Intellectual Property and sensitive data. Evaluate Statements of Work, Service Level Agreements, Business Associate Agreements, and contract protections are in place. Asses the partners’ cyber security frameworks and independent certifications/attestations’ for security risk and required user controls and report any findings to the appropriate stakeholders and the CISO.
Liaise with internal Audit team to review and evaluate the design and operational effectiveness of cyber security related controls.
Support the testing and validation of internal cyber security controls; as directed by the CISO.
Review and stay current on security technologies, tools, services, and processes and make recommendations to the broader security, IT teams, compliance teams for their use, based on security, financial, and operational metrics.
Coordinate with operational and facility management teams to assess the physical and operational security and Internet of Things systems.
Liaise with other security, enterprise, and solution architects and security practitioners to share best practices and insights.
Liaise with the Emergency Preparedness Committee and business services lines to validate security practices for business continuity and disaster recovery teams.
Develop a strong understanding of LHC business, information technology and system processes along with key stakeholders across the enterprise and industry.
Examine internal cyber security controls, evaluate the design and operational effectiveness, determine exposure to risk and develop remediation strategies.
Participate in the LHC’s change management process.
Conduct integrated information technology audits, including but not limited to pre/post-implementation phases, privacy, data governance, and cybersecurity reviews using accepted audit and risk assessment frameworks adopted to the LHC environment.
Communicate complex technical issues in a simplified manner to relevant staff and management.
Other duties as assigned.
5+ years’ experience as a cyber security architect; health care experience preferred.
5+ years’ experience as a technical or solutions architect
Bachelor’s Degree in Information Technology/Computer Science or related degree
Deep knowledge of NIST CSF, 800-53, ISO 2700X, SOC2 security frameworks
Experience with Active Directory, IIS, Windows servers, SQL Server, Firewalls, Routers, WAPs, End Point Security, Virtualization Technologies, Mobile Device Management, Application Management, VPN, Asset Management, Patch Management, Vulnerability Scanners, Kali Linux, and Threat Hunter technologies
Working knowledge of .Net and/or Powershell
Ability to work in a fast paced environment
Strong attention to detail with an analytical mind and outstanding problem solving skills.
Great awareness of cyber security trends and hacking techniques
Certified Information Security Auditor (CISA) certification